GDPR

The regulation

The General Data Protection Regulation (EU Regulation 2016/679, the “GDPR”) has applied since 25 May 2018. It creates obligations for organisations that process personal data, and rights for the people whose data is processed.

Who is responsible for what

This is the point to understand before all others, because it determines whom a visitor to your site must contact.

Visiting this site, message sent through its widget

CoderKaine, controller.

Account, organisation, members, authentication

CoderKaine, controller.

Billing and accounting

CoderKaine, controller.

Trame feedback and conversations submitted by your visitors

You, controller; CoderKaine, processor.

Pages shared by your visitors with Gouvernail

You, controller; CoderKaine, processor.

Instructions given to Pilote by your users

You, controller; CoderKaine, processor.

In other words: for what your visitors submit or show, we are your processor. We carry, store where intended and present it, on your instruction, never on our own behalf.

What we have put in place

• An explicit contractual framework: this page and the terms of use allocate the obligations.
• Minimisation by design: a Trame rating or contact request carries no technical context; the visitor's address stays optional; Pilote keeps no conversation; Gouvernail deletes the page copy when the session ends.
• Masking on the device: secrets found by Trame replaced before any sending; input masked by Gouvernail, never shown for a password or a card field.
• Servers in France, at QUIDDEM SAS on OVHcloud infrastructure; our sub-processors are named below, and Stripe and Google may process data outside the European Union.
• Automatic purging of Trame feedback left without activity beyond the period set on the project; the contact directory, however, is not purged.
• Breach notification: if a breach affected data we process for you, we would inform you without undue delay, as Article 33 of the GDPR requires, so you can meet your own notification obligation.

What falls to you

Installing a widget is a processing decision. As the controller, it is up to you to:

• Inform your visitors: mention the widget in your own privacy policy, with what is collected, why, who hosts it and for how long. The privacy policy gives you everything to reuse.
• Establish a legal basis: legitimate interest for feedback submitted voluntarily, consent if your context requires it. We cannot decide for you.
• Choose your level of collection: with Trame, data-capture-requests="false" turns off network capture and data-types restricts the kinds offered; with Gouvernail, data-ck-block removes an area from sharing; with Pilote, only place the widget on the pages where it should act.
• Protect sensitive pages: on a page that handles health, banking or identity data, turn off Trame's network capture and block the relevant areas for Gouvernail. Gouvernail shows the page address, parameters included: do not put sensitive data in it.
• Handle your visitors' requests: they come to you to access their data or have it erased. You can delete feedback from Trame; we help you with what the interface does not allow.
• Set your retention: set the retention period of each Trame project according to your own policy; the contact directory is not purged automatically.
• Only declare domains you control: widget keys are bound to the domain.

Sub-processors

To carry out our task, we use the following sub-processors, each for the part needed for its task. Any change to this list is published on this page, with its date of update.

QUIDDEM SAS

Hosting of the site, the three products and the account area, in France.

OVHcloud

Sub-processor of QUIDDEM SAS: compute servers, databases, files attached to feedback and Pilote's language model, in France.

Mailjet

Sending of transactional emails: verification codes, invitations, product notifications, billing notices.

Stripe

Collection of card payments.

Pennylane

Issuing and keeping invoices.

Outside the European Union. Stripe, for payment collection, and Google, for the fonts loaded by the applications, may process data outside the European Union.

Retention periods

Trame feedback and conversations

90 days without activity by default, adjustable per project; at most 7 days on the Discovery plan. The period runs from when the feedback was submitted or, for a conversation, from its last message; email replies and internal notes do not extend it.

Trame contact directory

Address, name, first and last visit of visitors who left their address: no automatic purge.

Gouvernail page copy

Deleted when the session ends.

Gouvernail event batches

Kept in a fixed-size buffer (128 MB), overwritten as it fills, with no guaranteed duration.

Gouvernail session history

Dates, agent, site origin and end reason, with no page content: no automatic purge.

You are a visitor to a site that installed a widget

If you submitted feedback, shared your page or gave an instruction on a site and want to access, correct or delete it, contact that site's publisher: they are the controller.

If you cannot identify that publisher, write to us at contact@coderkaine.com stating the domain concerned: we will pass your request on to the controller and tell you so.

Write to us

For any question about data, write to contact@coderkaine.com.

Finally, you may lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.